Legal Penetration Test Agreement

LEGAL PENETRATION TEST AGREEMENT

This Legal Penetration Test Agreement (the "Agreement") is entered into as of by and between Client Name: , Client Entity Type: Corporation LLC Other, and Provider Name: , Provider Entity Type: Corporation LLC Other.

RECITALS

WHEREAS, Client desires to retain Provider to perform authorized penetration testing and related security assessment services against systems and assets owned or controlled by Client (the "Engagement"); and

WHEREAS, Provider represents that it has the requisite expertise, personnel, tools, and lawful authority to perform penetration testing in accordance with this Agreement and applicable law; and

WHEREAS, the parties intend to document the scope, limitations, responsibilities, confidentiality obligations, and allocation of risk arising from the Engagement.

NOW, THEREFORE, in consideration of the mutual covenants and promises contained herein, the parties agree as follows:

1. DEFINITIONS

1.1 "Authorized Testing" means only those tests expressly set forth in the Scope of Engagement and performed during the authorized test window. Unauthorized testing is strictly prohibited.

1.2 "Target Systems" means the hostnames, IP addresses, applications, or environments listed in the Scope of Engagement and any written amendments thereto.

1.3 "Report" means the technical and executive summary deliverables described in Section 6, including vulnerability findings, risk ratings, reproduction steps, and remediation recommendations.

2. SCOPE OF ENGAGEMENT

2.1 Services. Provider will perform penetration testing and related activities described in the Engagement Scope:

2.2 Test Window. Testing shall occur during the period beginning on and ending on , unless extended by mutual written agreement.

3. AUTHORIZATION, LIMITATIONS AND SAFEGUARDS

3.1 Authorization. Client hereby expressly authorizes Provider and its personnel to conduct Authorized Testing against the Target Systems during the Test Window. Client warrants that it has the legal right to authorize such testing and agrees to hold Provider harmless for actions taken within the scope of this authorization.

3.2 Limitations. Provider will not exploit vulnerabilities to the extent that it causes permanent degradation or destruction of Client systems. Provider shall not conduct denial-of-service attacks, destructive actions, or any activity likely to render systems unavailable unless expressly agreed in writing and with specific mitigations in place.

Network penetration testing Web application testing Social engineering (phishing) Physical security testing

4. METHODOLOGY, TOOLS AND ACCESS

4.1 Methods and Tools. Provider shall use industry-standard manual and automated techniques. Provider will provide a non-exhaustive list of major tools upon request and will not knowingly use malware or tools designed primarily to cause harm unless Client consents in writing and appropriate safeguards are in place.

4.2 Credentials and Access. If credentialed testing is authorized, Client shall supply necessary credentials, access accounts, and test data. Provider shall use such credentials solely for the purpose of Authorized Testing and shall not retain credentials beyond the engagement without Client consent.

5. DATA HANDLING, CONFIDENTIALITY AND PRIVACY

5.1 Confidentiality. Provider shall treat all non-public information obtained in connection with the Engagement as Confidential Information. Provider will not disclose Confidential Information except to its personnel bound by confidentiality obligations or as required by law.

5.2 Data Retention and Destruction. Provider shall retain copies of test data, logs, and reports only for the retention period specified: days, after which Provider shall securely destroy or return such materials to Client unless otherwise required by law.

5.3 Breach Notification. In the event Provider reasonably believes that the Engagement caused an unintended disclosure or incident, Provider shall notify Client within hours and shall cooperate in good faith with Client to investigate and remediate.

6. REPORTING AND DELIVERABLES

6.1 Deliverables. Provider will deliver a technical Report and an executive summary containing findings, risk ratings, evidence, and remediation recommendations. Delivery of the Report will occur within days after completion of testing.

7. REMEDIATION AND RETESTING

7.1 Remediation. Client retains sole responsibility for remediation of identified vulnerabilities. Provider may offer remediation assistance under a separate agreement.

7.2 Retesting. If retesting is requested, Provider will perform verification of remediated items in accordance with the retest terms:

8. FEES, EXPENSES AND PAYMENT

8.1 Fees. Client shall pay Provider the fees set forth herein. Total Fee: $ , payable in accordance with the payment schedule below.

9. LIABILITY, INDEMNIFICATION AND INSURANCE

9.1 Limitation of Liability. Except for liability arising from Provider's gross negligence or willful misconduct, Provider's aggregate liability to Client for any claim arising out of or relating to this Agreement shall not exceed $ or the total fees paid under this Agreement, whichever is less.

9.2 Indemnification. Client agrees to indemnify, defend and hold harmless Provider from and against third-party claims arising from Client's negligent configuration, unauthorized systems, or acts outside the scope of this Agreement. Provider shall indemnify Client for claims resulting from Provider's gross negligence or willful misconduct.

9.3 Insurance. Provider represents that it maintains commercially reasonable professional liability and cyber liability insurance coverage appropriate to the size and scope of the Engagement.

10. TERM, TERMINATION AND SUSPENSION

10.1 Term. This Agreement commences on the Effective Date and continues until completion of the Engagement or earlier termination as provided herein.

10.2 Termination. Either party may terminate this Agreement for material breach upon thirty (30) days' written notice if the breach remains uncured. Client may suspend testing immediately if Provider's activities present an imminent risk to production systems, subject to good faith consultation.

11. COMPLIANCE WITH LAW

11.1 General. Each party shall perform its obligations under this Agreement in compliance with applicable laws, regulations, and binding third-party contractual restrictions applicable to the party's performance.

12. NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the addresses set forth below or to such other address as a party may designate in writing.

13. MISCELLANEOUS

13.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction of: , without regard to conflict of laws principles.

13.2 Entire Agreement. This Agreement constitutes the entire agreement between the parties regarding the subject matter hereof and supersedes all prior and contemporaneous understandings, agreements, representations and warranties, both written and oral.

13.3 Severability. If any provision of this Agreement is held to be invalid or unenforceable by a court of competent jurisdiction, the remainder of this Agreement shall remain in full force and effect.

13.4 Amendments and Waiver. Any amendment or waiver of any provision of this Agreement must be in writing and signed by authorized representatives of both parties. Failure or delay to exercise any right shall not operate as a waiver.

13.5 Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one instrument. Electronic or facsimile signatures shall be binding.

Sign Now